From bf3940d944640a6cde7fcad0ba1461dd4a132c4f Mon Sep 17 00:00:00 2001 From: terrynini38514 Date: Wed, 10 Jul 2024 12:37:41 +0800 Subject: [PATCH 1/3] Fix CVE-2024-26256 --- libarchive/archive_read_support_format_rar.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c index fb7cfde7b..98ec31f91 100644 --- a/libarchive/archive_read_support_format_rar.c +++ b/libarchive/archive_read_support_format_rar.c @@ -3428,6 +3428,12 @@ run_filters(struct archive_read *a) return 0; } + if ( filter->blocklength > VM_MEMORY_SIZE ) + { + archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT, "Bad RAR file data"); + return 0LL; + } + ret = copy_from_lzss_window(a, filters->vm->memory, start, filter->blocklength); if (ret != ARCHIVE_OK) return 0; From e77203d934cbd90432c00d58f4789ec1d9c18337 Mon Sep 17 00:00:00 2001 From: terrynini Date: Thu, 8 Aug 2024 11:44:45 +0800 Subject: [PATCH 2/3] Update libarchive/archive_read_support_format_rar.c Co-authored-by: Timothy Lyanguzov --- libarchive/archive_read_support_format_rar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c index 98ec31f91..4f8760c5b 100644 --- a/libarchive/archive_read_support_format_rar.c +++ b/libarchive/archive_read_support_format_rar.c @@ -3431,7 +3431,7 @@ run_filters(struct archive_read *a) if ( filter->blocklength > VM_MEMORY_SIZE ) { archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT, "Bad RAR file data"); - return 0LL; + return 0; } ret = copy_from_lzss_window(a, filters->vm->memory, start, filter->blocklength); From 33c0bfc8b8d36bbc2ccfe6f76d1c0cbee06f8397 Mon Sep 17 00:00:00 2001 From: terrynini Date: Thu, 8 Aug 2024 11:44:51 +0800 Subject: [PATCH 3/3] Update libarchive/archive_read_support_format_rar.c Co-authored-by: Timothy Lyanguzov --- libarchive/archive_read_support_format_rar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libarchive/archive_read_support_format_rar.c b/libarchive/archive_read_support_format_rar.c index 4f8760c5b..f4dcb7528 100644 --- a/libarchive/archive_read_support_format_rar.c +++ b/libarchive/archive_read_support_format_rar.c @@ -3428,7 +3428,7 @@ run_filters(struct archive_read *a) return 0; } - if ( filter->blocklength > VM_MEMORY_SIZE ) + if (filter->blocklength > VM_MEMORY_SIZE) { archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT, "Bad RAR file data"); return 0;